April 2022 Summaries

Tailscale has announced a successful $100 million Series B funding round, attributing its success to the community's support and engagement. The company has introduced several new features and community contributions, including the ability to sync Okta groups for Access Control Lists (ACLs), integrate Tailscale authentication with NGINX, and run Tailscale on Android TV and Minecraft servers. The newsletter also highlights customer stories, such as Cobalt Speech and Yugabyte, which have benefited from Tailscale's VPN solution, and offers various tutorials and insights from the community on using Tailscale with different technologies like Synology NAS, macOS, and NFS. The newsletter emphasizes Tailscale's role as a user-friendly and effective alternative to traditional VPN solutions, showcasing its versatility across multiple platforms and its contribution to simplifying network connectivity.

In an interview with CyberNews, David Crawshaw, co-founder and CTO of Tailscale, discusses the challenges and innovations in cybersecurity, particularly in the context of modern interconnected digital life. He highlights that while technological advancements, such as the internet and Wi-Fi, have boosted connectivity, they have also increased privacy and security concerns. Tailscale was developed as a response to these issues, aiming to create safer and more reliable network environments by utilizing a point-to-point mesh network built on the WireGuard protocol. Crawshaw elaborates on the company's vision to return to the original, more trusted vision of the internet, and the importance of open-source software in their approach. Moreover, he addresses the impact of the COVID-19 pandemic on cybersecurity perceptions and the shift towards remote work, recommending robust communication practices and investments in technologies like two-factor authentication and Single Sign-On (SSO) to enhance security. Tailscale aims to simplify network management and expand its applications beyond traditional business VPNs to everyday household devices, addressing the complexity caused by untrustworthy networks.

The blog post outlines a method for integrating Tailscale authentication with services behind NGINX, building on previous examples with Grafana and Minecraft. It introduces nginx-auth, a tool designed to use the NGINX HTTP subrequest authentication protocol to authenticate internal service requests, adding appropriate HTTP headers. The installation process for nginx-auth is detailed, including configuration steps for Ubuntu systems and guidance for using systemd to manage the service. The setup enables Single-Sign-On (SSO) benefits without the complexities of traditional OAuth2 systems, leveraging Tailscale's identification capabilities. By using UNIX sockets, the proxy enhances security by preventing network exposure and allowing access control through filesystem permissions. Readers are encouraged to provide feedback and engage with the Tailscale community to influence future development efforts.

Elias Naur's guest post details the integration of Tailscale with Android TV, allowing users to connect to big screens without needing a desktop or mobile device, which is especially useful for accessing home media servers while traveling. The Tailscale Android app, now supporting Android TV and available on the Google Play Store, faced challenges due to its user interface being built with Gio, which initially lacked support for TV remote control navigation. This required enhancements to allow remote navigation using directional buttons and activation, alongside logical grid partitioning for widgets and off-screen focus management. Despite the challenges of developing a custom GUI toolkit from scratch, using Gio offers benefits such as compatibility with Go, portability across platforms, and simplified UI logic. The post encourages users to try the Tailscale app on Android TV by downloading it from the Play Store.

Tailscale has introduced a new feature that allows organizations to sync Okta groups for use in their Access Control Lists (ACLs), easing the process of managing user access in response to changes like onboarding, offboarding, or team shifts. By leveraging the System for Cross-domain Identity Management (SCIM), Tailscale can automate the synchronization of group membership and deactivated user accounts from Okta, enabling admins to maintain up-to-date access permissions across their network without manual intervention. This integration allows administrators to use existing group definitions from their identity provider for more streamlined and scalable management of access permissions within Tailscale. The feature, now available in beta, supports Tailscale's Business plan, enhancing the flexibility and efficiency of managing network security and access controls for organizations using Okta as their identity provider.

The blog post explores the creative application of using Tailscale, a VPN service, for authentication on a Minecraft server, allowing users to secure server access by integrating it into a private tailnet. This setup restricts server access to known users, enhances logging, and works without modifying the Minecraft server with third-party mods, maintaining a vanilla setup. However, there are limitations, such as incompatibility with the Bedrock version of Minecraft, the need to disable standard authentication, and potential issues with Tailscale usernames. The process involves setting up an authentication proxy using a patched version of the Infrared software, which allows the server to operate in offline mode, bypassing Mojang's authentication servers. This setup leverages Tailscale's MagicDNS feature for domain management, ensuring a secure and private gaming environment for trusted players.

Tailscale's inclusion in Wing Venture Capital’s 2022 Enterprise Tech 30 List marks its recognition as a promising private company in enterprise technology, highlighting its potential to transform tech enterprises. This inclusion signifies Tailscale's growing reputation for providing secure, low-latency network connectivity solutions, particularly valuable as organizations adapt to new work models like remote and hybrid setups. Co-founders David Crawshaw and Avery Pennarun emphasize that Tailscale's rapid growth is due to its ability to seamlessly integrate connectivity and security, offering a user-friendly, cost-effective solution that requires no additional hardware or infrastructure. This approach allows enterprises to enhance productivity by securely connecting devices and services without the traditional limitations associated with VPNs.

In this blog post, the author explains how to seamlessly integrate Tailscale with Grafana for authentication purposes in a DevOps environment, highlighting the benefits of using Tailscale's existing identity management to streamline access control. The process involves configuring Grafana to accept authentication via Tailscale's local API server, which identifies users based on their Tailscale profiles, allowing applications like Grafana to leverage centralized identity management instead of maintaining separate authentication systems. A step-by-step guide is provided, detailing necessary changes to Grafana's configuration files and the installation of a custom authentication proxy available on GitHub, written in Go, which facilitates this integration. This method not only simplifies user onboarding and offboarding but also enhances security by ensuring only authenticated Tailscale users can access the service. The technique is applicable to other internal tools and services that can be configured to read user information over HTTP headers, offering a scalable solution for managing internal access in a secure and efficient manner.

The March Tailscale newsletter highlights various community and team contributions, advancements, and use cases for Tailscale, a VPN service that simplifies secure networking. Notable updates include the general availability of ACL tags, which enhance security and management by allowing devices to be tagged and authenticated, and the introduction of auto approvers for routes and exit nodes, which streamline network configuration. The newsletter also showcases creative applications of Tailscale, such as using it to connect to Synology NAS remotely, setting up a VPN gateway on a Raspberry Pi, and integrating with services like Grafana and Caddy for seamless authentication and certificate management. Additionally, the newsletter mentions Tailscale's recognition in the Enterprise Tech 30 list, as well as various community-driven projects and insights that demonstrate the versatility and potential of Tailscale in different networking scenarios.

Faced with limitations from using etcd for their database, the team opted to transition to SQLite with the aid of Litestream, a tool that facilitates live replication by streaming SQLite's WAL file changes to S3. This approach allows near real-time backups without modifying SQLite, providing a more scalable and manageable solution. The migration process involved creating a main SQLite database for high-value data and a separate one for ephemeral data, with schema changes made to better suit their needs. The transition from etcd was executed in stages, initially writing data to both systems before fully switching to SQLite. Despite some challenges with schema migrations and the need for extensive service code modifications, SQLite proved effective, with tuning required under load conditions. The team anticipates further improvements, including setting up read-only Litestream replicas, as they continue refining their database architecture to alleviate past complexities and enhance scalability and ease of use.